bamaer opened a new issue, #8394: URL: https://github.com/apache/hop/issues/8394
### What needs to happen? The Arrow Flight server has no transport security and no authentication, and neither can be configured. Connections are built with `Location.forGrpcInsecure` in all three places the plugin creates one: - `flight/ArrowFlightServer.java:61` (server) - `flight/HopFlightProducer.java:173` (producer) - `datastream/flight/ArrowFlightDataStream.java:202` (client) `FlightServer.builder(allocator, location, producer).build()` (`ArrowFlightServer.java:64`) attaches no authentication handler or middleware, and the plugin source contains no reference to TLS, certificates or tokens anywhere. The shipped defaults bind `0.0.0.0:33333` (`ArrowCommand.java:59` and `:65`), and `--arrow-flight-host` and `--arrow-flight-port` are the only options. Anything that can reach the port can read the data the server streams, and the data travels in the clear. This is missing functionality rather than an insecure default: there is no setting an operator can change. ## Proposed change Add options for TLS (`Location.forGrpcTls` with a certificate and key) and for authentication (a `CallHeaderAuthenticator` or server middleware), on both the server and the client side so a secured server stays usable from the data stream transform. ## Separable, and worth deciding on its own The `0.0.0.0` bind default could move to `127.0.0.1`, which removes the exposure for anyone who has not deliberately opened the service up. It is a behaviour change for cross-host use, which is much of the point of Flight, so it is a judgement call rather than an obvious win — but it is one line and does not wait on the work above. ## Note Until this lands, the Flight server should be treated as a plaintext, trusted-network-only service and kept off any interface it does not need to be on. Worth stating in the documentation, and in the threat model's network surface inventory, which does not currently list it. ### Issue Priority Priority: 2 ### Issue Component Component: Metadata -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
